AI-Based UFDR Report Analysis and Intelligent Digital Forensic Investigation Assistant using Explainable Machine Learning

Prabha K, L Thara and Anita Sofia Vs

International Journal of Scientific Research in Computer Science, Engineering and Information Technology, 2026, vol. 12, issue 5, 233-241

Abstract: Mobile and application-derived artefacts are becoming more central to digital forensic investigations; however, they can be a diverse set of evidence in a UFDR which are hard to prioritize manually. Mobile and application derived-artifacts are becoming more important to digital forensic investigations, and can be a diverse set of evidence in a UFDR that is difficult to manually prioritize. In the paper, the authors propose an Artificial Intelligence-based UFDR report analysis and intelligent digital forensic investigation assistant to transform the extracted report information into a structured and explainable analysis flow. The prototype now supports reading reports in JSON, XML, CSV and ZIP formats, validates the uploaded report, calculates an integrity checksum (SHA-256), and stores proof of the integrity in SQLite. Twenty behavioral features are created in communication, temporal, browser, application, and file activity. The trained Random Forest (RF) classifier enables three-way classification, and a trained Isolation Forest (Anomaly scoring) is used. A suspicious detector based on the 4 parameters is set, and activates when late-night activity is detected, or when suspicious incoming/outgoing communication, suspicious text indicators or high anomaly scores are detected. The conditions are combined using UNION logic and deduplicated by evidence identifier to return suspicious and/or critical records to the investigators. Risk engine helps transform the model and indicator outputs are mapped to a 0-100 score, and with the help of SHAP Tree Explainer, it is possible to get feature contributions by the model and a human-readable “WHY?” explanation based on evidence. An evidence-based assistant retrieves case, analysis and explanation information from the database and provides a deterministic answer when the language-model service is not available. The accuracy of the test split was 93% and F1-score, recall and macro precision were all approximately 0.93 for the synthetic benchmark that was reproduced using the project. Suspicious-detector tests were also conducted successfully, with special emphasis on specific tests. This system instead of the automatic finding of criminal conduct presents a non-automatic triage system, explainability and a conversational workflow for forensic decision support.

Keywords: Artificial Intelligence; Digital Forensics; Explainable AI; SHAP; UFDR (search for similar items in EconPapers)
Date: 2026
Note: Article URL: https://ijsrcseit.com/home/article/view/CSEIT2612529
References: Add references at CitEc
Citations:

Downloads: (external link)
https://ijsrcseit.com/home/article/view/CSEIT2612529 Article URL (text/html)
https://ijsrcseit.com/home/article/download/CSEIT2612529/CSEIT2612529 Full text (application/pdf)

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:jbh:ijsrcs:v12:y2026:i5:id:2172

DOI: 10.32628/CSEIT2612529

Access Statistics for this article

More articles in International Journal of Scientific Research in Computer Science, Engineering and Information Technology from International Journal of Scientific Research in Computer Science, Engineering and Information Technology
Bibliographic data for series maintained by Pankaj Sharma ().